Dynamic second factor authentication for cookie-based authentication

1. A method comprising:

sending, by a physical processor of a server, a seed value to a client that allows the client to establish a first key at the client;

receiving at the server a first encrypted session identifier (ID), which is a session ID encrypted using the first key, wherein the first encrypted session ID is received without the seed value that was sent to the client;

establishing, by the physical processor, the first key using the seed value that is not received with the first encrypted session ID;

decrypting, by the physical processor, the first encrypted session ID using the first key to obtain the session ID;

validating, by the physical processor, the session ID;

determining, by the physical processor using the seed value, a plurality of second keys that are different from the first key;

receiving at the server a second encrypted session ID, which is the session ID encrypted with a third key; and

decrypting, by the physical processor using the plurality of second keys, the second encrypted session ID encrypted with the third key until one of the second keys successfully decrypts the second encrypted session ID to obtain the session ID.

2. The method of claim 1 , wherein:

the receiving of the first encrypted session ID comprises receiving the session ID encrypted with the first key that has been generated by a first pseudorandom number generator (PRNG) at the client based on the seed value;

the decrypting of the first encrypted session ID using the first key comprises decrypting the first encrypted session ID with the first key that has been generated by a second PRNG at the server based on the seed value; and

the third key is generated by the first PRNG at the client based on the seed value and the plurality of second keys are generated by the second PRNG at the server based on the seed value.

3. The method of claim 2 , further comprising:

receiving an identifier with the first encrypted session ID, wherein the identifier is indicative of a state of the first PRNG; and

synchronizing, by the processor, the second PRNG with the first PRNG using the identifier.

4. The method of claim 1 , wherein sending the seed value to the client comprises sending the seed value using Hypertext Transfer Protocol Secure (HTTPS) protocol.

5. The method of claim 1 , further comprising determining the third key, wherein the determining the third key comprises:

receiving an encrypted key contribution value from the client;

decrypting the key contribution value using the first key; and

updating the first key by calculating an update function of the first key and the key contribution value, to derive the third key.

6. The method of claim 1 , further comprising:

receiving a timestamp with the first encrypted session ID; and

using the timestamp to establish the first key at the server.

7. The method of claim 1 , wherein the seed value is a random seed value generated by a random number generator.

8. One or more computer readable non-transitory storage media encoded with software comprising computer executable instructions that, when executed by a processor, cause the processor to:

send a seed value to a client that allows the client to establish a first key at the client;

receive a first encrypted session identifier (ID), which is a session ID encrypted using the first key, wherein the first encrypted session ID is received without the seed value that was sent to the client;

establish the first key at the server using the seed value that is not received with the first encrypted session ID;

decrypt the first encrypted session ID using the first key to obtain the session ID;

validate the session ID;

determine, using the seed value, a plurality of second keys that are different from the first key;

receive a second encrypted session ID, which is the session ID encrypted with a third key; and

decrypt, using the plurality of second keys, the second encrypted session ID encrypted with the third key until one of the second keys successfully decrypts the second encrypted session ID to obtain the session ID.

9. The computer readable non-transitory storage media of claim 8 , wherein the instructions further cause the processor to:

receive the session ID encrypted with the first key that has been generated by a first pseudorandom number generator (PRNG) at the client based on the seed value; and

decrypt the first encrypted session ID with the first key that has been generated by a second PRNG at the server based on the seed value,

wherein the third key is generated by the first PRNG at the client based on the seed value and the plurality of second keys are generated by the second PRNG at the server based on the seed value.

10. The computer readable non-transitory storage media of claim 9 , further comprising instructions that cause the processor to:

receive an identifier with the first encrypted session ID, wherein the identifier is indicative of a state of the first PRNG; and

synchronize the second PRNG with the first PRNG using the identifier.

11. The computer readable non-transitory storage media of claim 8 , wherein the instructions further cause the processor to send the seed value to the client using Hypertext Transfer Protocol Secure (HTTPS) protocol.

12. The computer readable non-transitory storage media of claim 8 , wherein the instructions further cause the processor to:

receive an encrypted key contribution value from the client;

decrypt the key contribution value using the first key; and

update the first key by calculating an update function of the first key and the key contribution value, to derive the third key.

13. The computer readable non-transitory storage media of claim 8 , wherein the instructions further cause the processor to:

receive a timestamp with the first encrypted session ID; and

use the timestamp to establish the first key at the server.

14. The computer readable non-transitory storage media of claim 8 , wherein the seed value is a random seed value generated by a random number generator.

15. An apparatus comprising:

a processor;

a network interface unit coupled to the processor and configured to enable network communications;

wherein the processor is configured to:

send a seed value to a client that allows the client to establish a first key at the client;

receive a first encrypted session identifier (ID), which is a session ID encrypted using the first key, wherein the first encrypted session ID is received without the seed value that was sent to the client;

establish the first key at the server using the seed value that is not received with the first encrypted session ID;

decrypt the first encrypted session ID using the first key to obtain the session ID;

validate the session ID;

determine, using the seed value, a plurality of second keys that are different from the first key;

receive a second encrypted session ID, which is the session ID encrypted with a third key; and

decrypt, using the plurality of second keys, the second encrypted session ID encrypted with the third key until one of the second keys successfully decrypts the second encrypted session ID to obtain the session ID.

16. The apparatus of claim 15 , wherein:

the received first encrypted session ID is encrypted with the first key that has been generated by a first pseudorandom number generator (PRNG) at the client based on the seed value;

the processor is configured to generate the first key using a second PRNG based on the seed value; and

the third key is generated by the first PRNG at the client based on the seed value and the plurality of second keys are generated by the second PRNG at the server based on the seed value.

17. The apparatus of claim 15 , wherein the processor is further configured to determine the third key by:

receiving an encrypted key contribution value from the client;

decrypting the key contribution value using the first key; and

updating the first key by calculating an update function of the first key and the key contribution value, to derive the third key.

18. The apparatus of claim 15 , wherein the processor is configured to establish the first key using a timestamp that is included with the first encrypted session ID.

19. The apparatus of claim 15 , wherein the processor is configured to send the seed value to the client using Hypertext Transfer Protocol Secure (HTTPS) protocol.

20. The apparatus of claim 15 , wherein the seed value is a random seed value generated by a random number generator.